Add LogicalCluster level quota

[mjudeikis]

Summary

Implements #4235: a hard limit on the total number of objects in a logical cluster (across all resource types) — something ResourceQuota cannot express. Protects a shard from a single workspace, creating unbounded objects.

How?

• A per-shard scanner periodically counts objects per logical cluster via a single keys-only etcd scan (--logical-cluster-object-count-scan-interval, default 60s). A new validating admission plugin (core.kcp.io/LogicalClusterObjectCountLimit) tracks deltas between scans (+1 create / −1 delete) and rejects creates with 403 Forbidden once the limit is reached.
• Limit resolution: core.kcp.io/max-total-objects annotation on the LogicalCluster (admin-only, protected by ReservedMetadata) takes precedence; otherwise the shard-wide --logical-cluster-total-object-limit flag applies (default 0 = disabled). Annotation <= 0 opts a logical cluster out. The default never applies to root/system:* clusters so shard bootstrap can't be blocked.
• Deletes, updates, subresources, and events are never blocked; enforcement only starts once the logical cluster is Ready. Counts are eventually consistent by design ("poor man's quota") — drift self-corrects each scan.
• Metrics kcp_logicalcluster_object_count{shard,cluster} / kcp_logicalcluster_object_limit are published only for clusters at ≥90% of their limit to keep cardinality bounded.

What Type of PR Is This?

/kind feature

Related Issue(s)

Fixes #

Release Notes

Add LogicalCluster quota limited --logical-cluster-object-count-scan-interval

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mjudeikis for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS
• pkg/admission/OWNERS
• staging/src/github.com/kcp-dev/sdk/apis/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment